# Ansible random generated passwords **URL:** \ **Category:** Get Help\ **Tags:** playbook\ **Created:** [May 9, 2024, 10:35am UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661 "2024-05-09T10:35:57Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Amit.z](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/amit.z/32/3375_2.png) [@Amit.z](https://forum.ansible.com/u/Amit.z)\ **Post date:** [May 9, 2024, 10:35am UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/1 "2024-05-09T10:35:57Z")
hey, my issue is this: i can’t use any mysql modules for my playbook as we user also CentOs7 servers which are not compatible with those modules. This is my role: ```auto - name: Check if "{{ dbuser }}" user exists shell: "{{ check_user }}" register: db_user_exists ignore_errors: true changed_when: false failed_when: false - name: Creates user for "{{ username | replace('.','_')}}_db" shell: "{{ create_user }}" when: db_user_exists.stdout == "" - name: Grant privileges on "{{ db }}" to "{{ dbuser }}" shell: "{{ priv_user }}" when: db_user_exists.stdout == "" - name: Flush privileges shell: "{{ flush_priv }}" when: db_user_exists.stdout == "" ``` And here are my vars inside the vars folder: ```auto user_pass_gen: "{{ lookup('community.general.random_string', length=13, min_lower=1, min_upper=1, min_numeric=1, min_special=1, override_special='-_=+!#$()[]') }}" dbuser: "{{ username | replace('.','_')}}_user" SECRETPASS: "{{ lookup('file', '/XXX/XXX/XXX') }}" check_user: mysql -u XXX_db -p"{{ pass }}" -e "SELECT user FROM mysql.user WHERE user = '{{ dbuser }}';" create_user: mysql -u XXX_XX -p"{{ pass }}" -e "CREATE USER {{ dbuser }}@localhost IDENTIFIED BY '{{ user_pass_gen }}';" 2>/dev/null priv_user: mysql -u XXX_XX -p"{{ pass }}" -e "GRANT ALL PRIVILEGES ON {{ username | replace('.','_')}}_db.* TO '{{ dbuser}}'@'localhost';" 2>/dev/null flush_priv: mysql -u XXX_XX -p"{{ pass }}" -e "flush privileges;" ``` At the end, a db and user are created, and I see the password of the user. I can also use these details for other playbooks. Ths strange thing is, when I copy the password and try to connect to mysql using that user and password, it won’t let me in. BUT! If within the playbook itself I will set the password as 1234 for example, (instead of the generated password) everything works just fine. I tried to generate a password with or without special characters, with and without numbers and etc… Any ides? Thx a lot XXX are for secret information ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [May 9, 2024, 10:39am UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/2 "2024-05-09T10:39:37Z")
You have removed the suggested use of three backticks to surround code with from the post template, and have rendered your posting largely unreadable to me. ---
**Author:** ![Amit.z](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/amit.z/32/3375_2.png) [@Amit.z](https://forum.ansible.com/u/Amit.z)\ **Post date:** [May 9, 2024, 10:46am UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/3 "2024-05-09T10:46:36Z")
Sorry I don’t understand what you mean ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [May 9, 2024, 11:26am UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/4 "2024-05-09T11:26:55Z")
![rabbit-10963](https://us1.discourse-cdn.com/ansible/original/2X/4/467cdc20abe78191c55f88909756f6e16eb2e4cd.png) This is the text pre-populated in the new post box. 🙂 ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [May 9, 2024, 12:13pm UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/5 "2024-05-09T12:13:09Z")
Hi, No idea as is. Perhaps try to remove shell stderr nullrouting from your mysql user creation command, see if you catch an error. I’d also try to use mysql modules just to check if behavior is consistant, though I understand you can’t rely on those in the end. Also, I agree with @jpmens, please format your code; it would be easier to decipher this way. Thanks ! ---
**Author:** ![mikemorency](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/mikemorency/32/2672_2.png) [@mikemorency](https://forum.ansible.com/u/mikemorency)\ **Post date:** [May 9, 2024, 12:37pm UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/6 "2024-05-09T12:37:46Z")
It seems like your user password can have bash parameter expansion characters in it (`$!()[]` for example), and you double quote the password in your shell command. instead of `"{{ pass }}"` in your mysql commands, try `'{{ pass }}'` edit: I see you mentioned trying without special characters, so my idea may not be good. Still might be worth double checking? ---
**Author:** ![ptn](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/ptn/32/481_2.png) [@ptn](https://forum.ansible.com/u/ptn)\ **Post date:** [May 9, 2024, 1:04pm UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/7 "2024-05-09T13:04:58Z")
I think you’re right on the quote thing ! I just ran this quick and dirty playbook in verbose mode several times in a row: ```yaml - hosts: localhost connection: local vars: user_pass_gen: "{{ lookup('community.general.random_string', length=13, min_lower=1, min_upper=1, min_numeric=1, min_special=1, override_special='-=+!#$()[]') }}" my_command: "echo {{ user_pass_gen }}" tasks: - shell: "{{ my_command }}" ``` And it fails from time to time as some chars are misinterpreted by shell (which is sh by default, so no bash parameter expansions, but close !). Just correctly quoting `{{ user_pass_gen }}` where you want to use it seems to work fine: ```yaml ... my_command: "echo \"{{ user_pass_gen }}\"" ... ``` ---
**Author:** ![Denney-tech](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/denney-tech/32/1556_2.png) [@Denney-tech](https://forum.ansible.com/u/Denney-tech)\ **Post date:** [May 9, 2024, 3:23pm UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/8 "2024-05-09T15:23:35Z")
> [@Amit.z](#): > > ```auto > user_pass_gen: "{{ lookup('community.general.random_string', length=13, min_lower=1, min_upper=1, min_numeric=1, min_special=1, override_special='-_=+!#$()[]') }}" > > ``` I would also suggest using an actual password generator and using a seed to make it idempotent (unlike the random\_string generator). [ansible.builtin.password lookup – retrieve or generate a random password, stored in a file — Ansible Community Documentation](https://docs.ansible.com/ansible/latest/collections/ansible/builtin/password_lookup.html#ansible-collections-ansible-builtin-password-lookup) ```auto user_pass_gen: "{{ lookup('ansible.builtin.password', '/dev/null', length=13, chars=['ascii_letters', 'digits'] seed=inventory_hostname) }}" ``` ---
**Author:** ![jpmens](https://sea1.discourse-cdn.com/ansible/user_avatar/forum.ansible.com/jpmens/32/5543_2.png) [@jpmens](https://forum.ansible.com/u/jpmens)\ **Post date:** [May 9, 2024, 4:28pm UTC](https://forum.ansible.com/t/ansible-random-generated-passwords/5661/9 "2024-05-09T16:28:52Z")
I love the `password` lookup plugin, and TIL about `seed` instead of using a file for idempotency (which I might not be able to). Thanks, @Denney-tech